Windows 10: ""Can't connect to the 'root\CMV2' WMI namespace" WMI Not enabled "

Can any one help me on the issue ""Can't connect to the 'root\CMV2' WMI namespace" WMI Not enabled "While doing Nessus scan on windows 2019 server

:)

 

WMI Repo Files Missing (Ran WMIDiag)

Good Afternoon,

I have an issue where my WMI is showing as invalid due to invalid namespace. I ran WMIDiag and tried about every solution I could find with no avail. I don't have much history with this so I'm not 100% what I should even be looking for other than I can see
some files missing that appear to be VERY important. I do see the 4 listed "missing" files existing under the Repository Folder and the security permissions seem to be full control to Admins and System so I don't think the issue is there. Thanks in advance!

.2769 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2770 15:25:32 (0) ** ----------------------------------------------------- WMI REPORT: BEGIN ----------------------------------------------------------

.2771 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2772 15:25:32 (0) **

.2773 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2774 15:25:32 (0) ** Windows 8.1 - No Service Pack - 64-bit (17763) - User 'CFO-228-LAPTOP1\POS' on computer 'CFO-228-LAPTOP1'.

.2775 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2776 15:25:32 (0) ** Environment: ........................................................................................................ OK.

.2777 15:25:32 (0) ** There are no missing WMI system files: .............................................................................. OK.

.2778 15:25:32 (1) !! ERROR: The following WMI repository file(s) is/are missing: ......................................................... 4 ERROR(S)!

.2779 15:25:32 (0) ** - INDEX.BTR

.2780 15:25:32 (0) ** - MAPPING1.MAP

.2781 15:25:32 (0) ** - MAPPING2.MAP

.2782 15:25:32 (0) ** - OBJECTS.DATA

.2783 15:25:32 (0) ** => To fix this issue:

.2784 15:25:32 (0) ** - ENSURE you have all access rights to the WMI repository folder.

.2785 15:25:32 (0) ** - ENSURE you run WMIDiag as an Administrator.

.2786 15:25:32 (0) ** => If the issue is not due to a lack of privileges, and folder/files are really missing, while

.2787 15:25:32 (0) ** the WMI service successfully started, then WMI will rebuild the repository based on the

.2788 15:25:32 (0) ** auto-recovery mechanism. In such a case, WMI repository files shoud be available after the execution

.2789 15:25:32 (0) ** of WMIDiag. Check WMIDiag LOG.

.2790 15:25:32 (0) ** => If the issue is NOT due to a lack of privileges, and folder/files are really missing, while

.2791 15:25:32 (0) ** the WMI service does not start, then additional errors should be displayed (i.e. registry, DCOM, service hosts).

.2792 15:25:32 (0) ** You must fix those issues first!

.2793 15:25:32 (0) ** => After fixing issues, if the files are still missing and if you do not want WMI to rebuild

.2794 15:25:32 (0) ** the WMI repository, then you must restore the WMI repository from a previous backup.

.2795 15:25:32 (0) ** Note: The System State backup or the System Restore snapshot contain a backup of

.2796 15:25:32 (0) ** of the WMI repository.

.2797 15:25:32 (0) ** => If no backup is available, you must rebuild the repository.

.2798 15:25:32 (0) ** Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository,

.2799 15:25:32 (0) ** otherwise some applications may fail after the reconstruction.

.2800 15:25:32 (0) ** This can be achieved with the following command:

.2801 15:25:32 (0) ** i.e. 'WMIDiag ShowMOFErrors'

.2802 15:25:32 (0) ** Note: Any missing MOF files, or existing MOF files not listed in the Auto-recovery

.2803 15:25:32 (0) ** registry key will be excluded from the WMI repository reconstruction.

.2804 15:25:32 (0) ** This may imply the lost of WMI registration information.

.2805 15:25:32 (0) ** Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing

.2806 15:25:32 (0) ** ALL fixes previously mentioned.

.2807 15:25:32 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory)

.2808 15:25:32 (0) ** => To rebuild the WMI repository, you must:

.2809 15:25:32 (0) ** - Reset the WMI repository

.2810 15:25:32 (0) ** (The WMI repository rebuilt is based on auto-recovery)

.2811 15:25:32 (0) ** i.e. 'WINMGMT /ResetRepository'

.2812 15:25:32 (0) ** OR

.2813 15:25:32 (0) ** - Salvage the WMI repository if you want to attempt the retrieval of good data from the

.2814 15:25:32 (0) ** inconsistent repository

.2815 15:25:32 (0) ** (The repository rebuilt is based on auto-recovery + salvage)

.2816 15:25:32 (0) ** i.e. 'WINMGMT /SalvageRepository'

.2817 15:25:32 (0) **

.2818 15:25:32 (0) ** WMI repository state: ............................................................................................... N/A.

.2819 15:25:32 (0) ** AFTER running WMIDiag:

.2820 15:25:32 (0) ** The WMI repository has a size of: ................................................................................... 34 MB.

.2821 15:25:32 (0) ** - Disk free space on 'C:': .......................................................................................... 388776 MB.

.2822 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2823 15:25:32 (2) !! WARNING: Windows Firewall: .......................................................................................... DISABLED.

.2824 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2825 15:25:32 (0) ** DCOM Status: ........................................................................................................ OK.

.2826 15:25:32 (0) ** WMI registry setup: ................................................................................................. OK.

.2827 15:25:32 (0) ** INFO: WMI service has dependents: ................................................................................... 2 SERVICE(S)!

.2828 15:25:32 (0) ** - Security Center (*) (WSCSVC, StartMode='Automatic')

.2829 15:25:32 (0) ** - Internet Connection Sharing (ICS) (*) (SHAREDACCESS, StartMode='Disabled')

.2830 15:25:32 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well.

.2831 15:25:32 (0) ** Note: If the service is marked with (*), it means that the service/application uses WMI but

.2832 15:25:32 (0) ** there is no hard dependency on WMI. However, if the WMI service is stopped,

.2833 15:25:32 (0) ** this can prevent the service/application to work as expected.

.2834 15:25:32 (0) **

.2835 15:25:32 (0) ** RPCSS service: ...................................................................................................... OK (Already started).

.2836 15:25:32 (0) ** WINMGMT service: .................................................................................................... OK (Already started).

.2837 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2838 15:25:32 (0) ** WMI service DCOM setup: ............................................................................................. OK.

.2839 15:25:32 (0) ** WMI components DCOM registrations: .................................................................................. OK.

.2840 15:25:32 (0) ** WMI ProgID registrations: ........................................................................................... OK.

.2841 15:25:32 (0) ** WMI provider DCOM registrations: .................................................................................... OK.

.2842 15:25:32 (0) ** WMI provider CIM registrations: ..................................................................................... OK.

.2843 15:25:32 (0) ** WMI provider CLSIDs: ................................................................................................ OK.

.2844 15:25:32 (0) ** WMI providers EXE/DLL availability: ................................................................................. OK.

.2845 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2846 15:25:32 (0) ** INFO: User Account Control (UAC): ................................................................................... ENABLED.

.2847 15:25:32 (0) ** => WMI tasks requiring Administrative privileges on this computer MUST run in an elevated context.

.2848 15:25:32 (0) ** i.e. You can start your scripts or WMIC commands from an elevated command

.2849 15:25:32 (0) ** prompt by right clicking on the 'Command Prompt' icon in the Start Menu and

.2850 15:25:32 (0) ** selecting 'Run as Administrator'.

.2851 15:25:32 (0) ** i.e. You can also execute the WMI scripts or WMIC commands as a task

.2852 15:25:32 (0) ** in the Task Scheduler within the right security context.

.2853 15:25:32 (0) **

.2854 15:25:32 (0) ** INFO: Local Account Filtering: ...................................................................................... ENABLED.

.2855 15:25:32 (0) ** => WMI tasks remotely accessing WMI information on this computer and requiring Administrative

.2856 15:25:32 (0) ** privileges MUST use a DOMAIN account part of the Local Administrators group of this computer

.2857 15:25:32 (0) ** to ensure that administrative privileges are granted. If a Local User account is used for remote

.2858 15:25:32 (0) ** accesses, it will be reduced to a plain user (filtered token), even if it is part of the Local Administrators group.

.2859 15:25:32 (0) **

.2860 15:25:32 (0) ** Overall DCOM security status: ....................................................................................... OK.

.2861 15:25:32 (0) ** Overall WMI security status: ........................................................................................ OK.

.2862 15:25:32 (0) ** - Started at 'Root' --------------------------------------------------------------------------------------------------------------

.2863 15:25:32 (0) ** WMI permanent SUBSCRIPTION(S): ...................................................................................... NONE.

.2864 15:25:32 (0) ** WMI TIMER instruction(s): ........................................................................................... NONE.

.2865 15:25:32 (1) !! ERROR: WMI MONIKER CONNECTION errors occured for the following namespaces: .......................................... 1 ERROR(S)!

.2866 15:25:32 (0) ** - ROOT/SECURITY, 0x80041003 - (WBEM_E_ACCESS_DENIED) Current user does not have permission to perform the action.

.2867 15:25:32 (0) **

.2868 15:25:32 (1) !! ERROR: WMI CONNECTION errors occured for the following namespaces: .................................................. 14 ERROR(S)!

.2869 15:25:32 (0) ** - ROOT/SECURITY, 0x80041003 - (WBEM_E_ACCESS_DENIED) Current user does not have permission to perform the action.

.2870 15:25:32 (0) ** - Root/subscription, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2871 15:25:32 (0) ** - Root/CIMV2, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2872 15:25:32 (0) ** - Root/CIMV2/Security, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2873 15:25:32 (0) ** - Root/CIMV2/Applications, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2874 15:25:32 (0) ** - Root/nap, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2875 15:25:32 (0) ** - Root/SECURITY, 0x80041003 - (WBEM_E_ACCESS_DENIED) Current user does not have permission to perform the action.

.2876 15:25:32 (0) ** - Root/STANDARDCIMV2, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2877 15:25:32 (0) ** - Root/WMI, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2878 15:25:32 (0) ** - Root/directory, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2879 15:25:32 (0) ** - Root/directory/LDAP, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2880 15:25:32 (0) ** - Root/Microsoft, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2881 15:25:32 (0) ** - Root/Microsoft/HomeNet, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2882 15:25:32 (0) ** - Root/aspnet, 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found.

.2883 15:25:32 (0) **

.2884 15:25:32 (1) !! ERROR: WMI GET operation errors reported: ........................................................................... 16 ERROR(S)!

.2885 15:25:32 (0) ** - Root, __SystemSecurity, 0x80041003 - (WBEM_E_ACCESS_DENIED) Current user does not have permission to perform the action.

.2886 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2887 15:25:32 (0) ** - ROOT/DEFAULT, __SystemSecurity, 0x80041003 - (WBEM_E_ACCESS_DENIED) Current user does not have permission to perform the action.

.2888 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2889 15:25:32 (0) ** - ROOT/SECURITYCENTER2, __SystemSecurity, 0x80041003 - (WBEM_E_ACCESS_DENIED) Current user does not have permission to perform the action.

.2890 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2891 15:25:32 (0) ** - ROOT/SECURITYCENTER, __SystemSecurity, 0x80041003 - (WBEM_E_ACCESS_DENIED) Current user does not have permission to perform the action.

.2892 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2893 15:25:32 (0) ** - Root/DEFAULT, LogFileEventConsumer, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2894 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2895 15:25:32 (0) ** - Root/DEFAULT, ActiveScriptEventConsumer, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2896 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2897 15:25:32 (0) ** - Root/DEFAULT, NTEventLogEventConsumer, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2898 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2899 15:25:32 (0) ** - Root/DEFAULT, SMTPEventConsumer, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2900 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2901 15:25:32 (0) ** - Root/DEFAULT, CommandLineEventConsumer, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2902 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2903 15:25:32 (0) ** - Root/DEFAULT, RegistryEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2904 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2905 15:25:32 (0) ** - Root/DEFAULT, RegistryKeyChangeEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2906 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2907 15:25:32 (0) ** - Root/DEFAULT, RegistryTreeChangeEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2908 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2909 15:25:32 (0) ** - Root/DEFAULT, RegistryValueChangeEvent, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2910 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2911 15:25:32 (0) ** - Root/DEFAULT, StdRegProv, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2912 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2913 15:25:32 (0) ** - Root/DEFAULT, SystemRestoreConfig, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2914 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2915 15:25:32 (0) ** - Root/DEFAULT, SystemRestore, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.

.2916 15:25:32 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'

.2917 15:25:32 (0) **

.2918 15:25:32 (0) ** WMI MOF representations: ............................................................................................ OK.

.2919 15:25:32 (0) ** WMI QUALIFIER access operations: .................................................................................... OK.

.2920 15:25:32 (0) ** WMI ENUMERATION operations: ......................................................................................... OK.

.2921 15:25:32 (0) ** WMI EXECQUERY operations: ........................................................................................... OK.

.2922 15:25:32 (0) ** WMI GET VALUE operations: ........................................................................................... OK.

.2923 15:25:32 (0) ** WMI WRITE operations: ............................................................................................... NOT TESTED.

.2924 15:25:32 (0) ** WMI PUT operations: ................................................................................................. NOT TESTED.

.2925 15:25:32 (0) ** WMI DELETE operations: .............................................................................................. NOT TESTED.

.2926 15:25:32 (0) ** WMI static instances retrieved: ..................................................................................... 20.

.2927 15:25:32 (0) ** WMI dynamic instances retrieved: .................................................................................... 0.

.2928 15:25:32 (0) ** WMI instance request cancellations (to limit performance impact): ................................................... 0.

.2929 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2930 15:25:32 (0) **

.2931 15:25:32 (0) ** 7 error(s) 0x80041003 - (WBEM_E_ACCESS_DENIED) Current user does not have permission to perform the action

.2932 15:25:32 (0) ** => This error is typically due to insufficient or restricted permissions in the examined system.

.2933 15:25:32 (0) ** => ENSURE you are a Full Administrator of the examined system, if the WMI provider or the

.2934 15:25:32 (0) ** WMI system security do not enforce any restrictions.

.2935 15:25:32 (0) **

.2936 15:25:32 (0) **

.2937 15:25:32 (0) ** 12 error(s) 0x8004100E - (WBEM_E_INVALID_NAMESPACE) Namespace specified cannot be found

.2938 15:25:32 (0) **

.2939 15:25:32 (0) ** 12 error(s) 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found

.2940 15:25:32 (0) ** => This error is typically a WMI error. This WMI error is due to:

.2941 15:25:32 (0) ** - a missing WMI class definition or object.

.2942 15:25:32 (0) ** (See any GET, ENUMERATION, EXECQUERY and GET VALUE operation failures).

.2943 15:25:32 (0) ** You can correct the missing class definitions by:

.2944 15:25:32 (0) ** - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command.

.2945 15:25:32 (0) ** Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.

.2946 15:25:32 (0) ** (This list can be built on a similar and working WMI Windows installation)

.2947 15:25:32 (0) ** The following command line must be used:

.2948 15:25:32 (0) ** i.e. 'WMIDiag CorrelateClassAndProvider'

.2949 15:25:32 (0) ** - a WMI repository corruption.

.2950 15:25:32 (0) ** In such a case, you must rerun WMIDiag with 'WriteInRepository' parameter

.2951 15:25:32 (0) ** to validate the WMI repository operations.

.2952 15:25:32 (0) ** Note: ENSURE you are an administrator with FULL access to WMI EVERY namespaces of the computer before

.2953 15:25:32 (0) ** executing the WriteInRepository command. To write temporary data from the Root namespace, use:

.2954 15:25:32 (0) ** i.e. 'WMIDiag WriteInRepository=Root'

.2955 15:25:32 (0) ** - If the WriteInRepository command fails, while being an Administrator with ALL accesses to ALL namespaces

.2956 15:25:32 (0) ** the WMI repository must be reconstructed.

.2957 15:25:32 (0) ** Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository,

.2958 15:25:32 (0) ** otherwise some applications may fail after the reconstruction.

.2959 15:25:32 (0) ** This can be achieved with the following command:

.2960 15:25:32 (0) ** i.e. 'WMIDiag ShowMOFErrors'

.2961 15:25:32 (0) ** Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing

.2962 15:25:32 (0) ** ALL fixes previously mentioned.

.2963 15:25:32 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory)

.2964 15:25:32 (0) **

.2965 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2966 15:25:32 (0) ** WMI Registry key setup: ............................................................................................. OK.

.2967 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2968 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2969 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2970 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2971 15:25:32 (0) **

.2972 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2973 15:25:32 (0) ** ------------------------------------------------------ WMI REPORT: END -----------------------------------------------------------

.2974 15:25:32 (0) ** ----------------------------------------------------------------------------------------------------------------------------------

.2975 15:25:32 (0) **

.2976 15:25:32 (0) ** ERROR: WMIDiag detected issues that could prevent WMI to work properly!. Check 'C:\USERS\POS\APPDATA\LOCAL\TEMP\WMIDIAG-V2.2_WIN8.1_.CLI.RTM.64_CFO-228-LAPTOP1_2019.06.25_15.25.02.LOG' for details.

.2977 15:25:32 (0) **

.2978 15:25:32 (0) ** WMIDiag v2.2 ended on Tuesday, June 25, 2019 at 15:25 (W:25 E:44 S:1).

***Moved from Windows 10/Windows settings***

 

WMI report inconsistent

When a security suite properly registers with WSC (Windows Security Center) it should have an entry in WMI. Here is the powershell version which should work
Get-WmiObject -Namespace root\SecurityCenter2 -Query 'select * from AntivirusProduct'

 

WMI report inconsistent

[running Windows 10 Creators]

Hi,

While investigating the "Error while updating ESET NOD32 Antivirus status to SECURITY_PRODUCT_STATE_ON." problem, I discovered something rather strange...

If I go to Security and Maintenance, the system reports that ESET NOD32 is turned on. However, if I use WMIC to list the installed security products this way :

wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value

the result is : No Instance(s) available.

This is inconsistent. Or Windows doesn't use WMI in the Security Center to retrieve the installed antivirus apps. Did I miss something ?